CVE-2026-90273: coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
In the Linux kernel, the following vulnerability has been resolved:
coresight: etm4x: missing cscfgcsdevdisableactiveconfig() in perf enable
In the perf enable path, there are missing cases where cscfgcsdevdisableactiveconfig() is not called:
- Branch broadcast is selected but not supported by the hardware - etm4enablehw() fails
This can lead to a leak of configdesc->activecnt. Fix this by properly calling cscfgcsdevdisableactiveconfig() in these error paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In the coresight etm4x perf enable error paths—when branch broadcast is selected but unsupported by the hardware and when etm4_enable_hw() fails—call cscfg_csdev_disable_active_config() to prevent a config_desc->active_cnt leak.
Event History
Frequently Asked Questions
Under what conditions can the configuration reference count leak?
The leak can occur in the perf enable path when branch broadcast is selected but unsupported by the hardware, or when etm4_enable_hw() fails. In those error paths, the active configuration was not disabled, leaving config_desc->active_cnt incremented.
What is the effect of the fix?
The fix calls cscfg_csdev_disable_active_config() in the affected perf enable error paths. This ensures config_desc->active_cnt is decremented when enabling cannot proceed.